CVE-2026-103690

A flaw in itsourcecode Leave Management System 1.0 allows for SQL injection due to insufficient handling of the LEAVEID argument within the /module/leave/controller.php file. This vulnerability can be exploited remotely, and an exploit has been published and may be used. No specific remediation o...

CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

EUVD-2026-90888

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-103690 itsourcecode Leave Management System controller.php sql injection

A flaw has been found in itsourcecode Leave Management System 1.0. This vulnerability affects unknown code of the file /module/leave/controller.php. Executing a manipulation of the argument LEAVEID can lead to sql injection. The attack may be performed from remote. The exploit has been published...

CVE-2026-62071

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

rubygem-katello: SQL injection in Registry Proxy via labels

A flaw was found in rubygem-katello. An SQL injection vulnerability exists in the Red Hat Satellite Katello Registry Proxy. The application fails to sanitize input parameters used in database queries within the RegistryProxiesController. The methods checkblobpushorglabel and...

SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when...

GHSA-33JQ-P8C2-Q3Q4 SiYuan: Unauthenticated SQL injection in searchDocs via unescaped keyword (publish mode): cross-notebook read/write with statement stacking

Summary The /api/filetree/searchDocs endpoint concatenates the caller-supplied search keyword directly into a SQL statement with no escaping and no parameter binding. The endpoint is gated by CheckAuth only reachable by the publish RoleReader token, and by the anonymous account when...

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071

The WordPress File Upload plugin (versions

EUVD-2026-90852

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62071 WordPress WordPress File Upload plugin <= 5.1.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in WordPress File Upload = 5.1.10 versions...

CVE-2026-62059

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62060

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in captivateaudio Captivate Sync captivatesync-trade allows Blind SQL Injection.This issue affects Captivate Sync: from n/a through 3.3.2...

CVE-2026-103338

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Unlimited Elements Unlimited Elements For Elementor Free Widgets, Addons, Templates unlimited-elements-for-elementor allows Blind SQL Injection.This issue affects Unlimited Elements For Elementor...

CVE-2026-102379

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in VillaTheme BuildKit – Product Builder for WooCommerce – Custom PC Builder woo-product-builder allows Blind SQL Injection.This issue affects BuildKit – Product Builder for WooCommerce – Custom PC...

EUVD-2026-90809

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62059

The Ultimate Member WordPress plugin (versions

CVE-2026-62059 WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...

CVE-2026-62059 WordPress Ultimate Member plugin <= 2.13.1 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in Ultimate Member Ultimate Member ultimate-member allows Blind SQL Injection.This issue affects Ultimate Member: from n/a through 2.13.1...